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@ Process and apparatus for managing network event counters. 



@ A process and apparatus for detecting the 
pccun^nce of an event threshold and perfonn- 
ing some JVpe of action in response to the 
detection. The disclosed use of the invention is 
tor managing communication connections in a 
networlc. An event counter, a sliding event 
threshold counter and a sliding interval counter 
are initialized to prescribed initial states at the 
stert of counter management At the expiration 
of an interval specified by ttie contente of the 
sliding interval counter, ttie sliding interval 
counter is incremented by an offset lime value 
and the sliding event tfireshold counter is up^ 
dated by the sum of an offset event value and 
JUT^ «»Jnter is Inae- 

mented on each occurcence of an event to be 
counted. Each time the event counter exceeds a 
threshold established by the sliding threshold 
event counter, the sliding threshold event 
cmjnter is incremented by the contents of the 
offset event value, and the hiding interval 
counter is updated to the sum of the offset time 
value and the present time. Thus, all values of 
interest are maintained by a combination of 
keeping an absolute count of the evente, and by 
sliding the contente of two countere. one erf 
which IS used to measure successive time inter- 
vals and the other to set a new ttireshold for 
each successive interval based on the offset 
mreshold and the absolute event count at the 
beginning of the interval. 



FIG, 1 




COMMUNICAFIONS 
CONTROLLER 



Jouve, 18, rue Saint-Denis, 75001 PARIS 



1 



EP 0 515 296 A1 



2 



The invention relates to event counting. In partic- 
ular, it relates to the accumulation of event Infonna- 
tion, such as network errors or usage Infonmation, for 
managing networks and In a way that conforms to cer- 
tain standard network specifications, such as set forth 
by the OS! standards. 

Network management applications often need to 
know, for a given type of event on a given connection, 
a variety of network performance items Including the 
total number of events that occur during the connec- 
tion, the number of times that the event occurrences 
reach some threshold value (threshold crossing), how 
often this is occurring, and other infbnmation. The in- 
vention has the ability to perform these and other 
functions in a novel manner that confbnms with OSI 
standards. 

Event counting is well known in various arts. For 
example, in the telephone switching art. It has been a 
common practice for many years to accumulate "peg" 
counts of the utilization of switching office resources 
as well as the number of trouble reports reported by 
the resources. Such peg counts are typically used to 
estimate the adequacy of tiie resources for handling 
call loads, especially during busy hour traffic. Event 
counting is also known in tiie computing art U.S. pa- 
tent 3,906,464 describes a computer monitoring sys- 
tem for detecting, filtering and storing both hardware 
and software events. The system is geared toward a 
debugging system, whereby system infbnmation can 
be gathered without interrupting the operation of the 
computer system, thereby avoiding a source of sys- 
tem distortion tiiat can render test results less useful. 
Event and error counting is also common in the net- 
working art for example to access tiie level of trans- 
mission quality of the various network connections 
between nodes and users. 

Typical known techniques for networks include 
accumulation of total error counts during a connection 
and the measuring of the duration of the connection; 
counting until a threshold is reached, irrespective of 
how long it takes to reach tiie threshold and counting 
to a threshold, thereafter followed by variations on the 
thresholds and timing intervals intended to discover 
bursty, but transient conditions, and actual degraded 
connections that should be retired. 

In U.S. patent 4,080,589, the occurrence of an er- 
ror triggers a timer and begins a counting internal. 
Subsequent errors occuning during the interval are 
counted until a predetemnined threshold is reached or 
the timing interval expires, tf the threshold is reached 
before expiration of the inten/ai, an alanm is signaled 
and the timer is reset to begin a new interval. Each 
subsequent error resets the timer until a complete er- 
ror free interval occurs. 

In U.S. patent 4,241,445, a time base circuit 
measures recurrent intervals T2; each T2 contains an 
intermediate interval T1. A first en-or counter counts 
errors up to a tiireshold during Intervals equal at most 



to T2 and at a minimum to T1. A second enror counter 
counts each threshold crossing of the first counter. 
The second counter signals an alarm when it reaches 
a predetermined value. 
5 In U.S. patent 4,291,403. if an en-or count ex- 

ceeds a predetermined threshold during an establish- 
ed time period, an alarm is generated and a second 
threshold is established to measure subsequent error 
rates. 

10 U.S. patent 4.339,657 establishes a variable time 

interval measured by a predetennnined number of op- 
erations that occur. The arrangement counts errors 
occurring during the operations and also counts the 
number of times that the error count crosses a prede- 

15 termined threshold. 

U.S. patent 4,800,562 is said to provide a contin- 
uous indication of data quality in a data stream. A first 
counter counts periodic events in a data stream. A 
second counter counts errors in tiie data stream. 

20 When the first counter overflows, it recycles and also 
resets the second counter. When the second counter 
overflows, it recycles and resets the first counter. If 
tiie error rate is low in relation to tiie periodic events, 
tiie first counter will prevent the second counter from 

25 overflowing. An overflow of tiie second counter indi- 
cates an excessive enxir condition. 

Other background art is described in U.S. patents 
4,363,123 and 4.291,403. 

While the known art is satisfactory in specific in- 

30 stances, the art does not provide sufficient flexibility 
for toda/s standards. Techniques are needed that 
enable tiie accumulation of infonmation that can be 
manipulated to provide a variety of measurements, 
while at the same time being efficient and simple to 

35 implement 

The Invention is a metiiod and apparatus for de- 
tecting tiie occurrence of an event threshold and per- 
forming some type of action in response to tiie detec- 
tion. Successive intervals of time are measured in any 

40 desired way. An indication is maintained of tiie total 
number of events that have occurred from tiie start of 
event monitoring. An event threshold comparison val- 
ue is established at the beginning of each interval. 
The established value is made relative to the total 

45 number of events that have occurred up to that point. 
In response to a prescribed stimulus, a comparison is 
made between tiie indication of the total number of 
eyerits that have occurred to the event comparison 
threshold value to detennine if tiie tiireshold has been 

50 reached during the present interval. The stimulus may 
be the occun-ence of an event, the expiration of an in- 
terval, or other desired stimulus. 

In a preferred embodiment, an event counter, a 
sliding event threshold counter and a sliding Interval 

55 counter are initialized to prescribed initial states at the 
start of counter management. At the expiration of an 
interval specified by tiie contents of tiie sliding interval 
counter, the sliding interval counter is incremented by 
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an offset time value, and the sliding event threshold 
counter is updated by the sum of an offset event value 
and the event counter. The event counter is incre- 
mented on each occurrence of an event to be count- 
ed. Each time the event counter exceeds a threshold 5 
established by- the sliding threshold event counter, the 
sliding threshold event counter is incremented by the 
contents of the offset event value, and the sliding in- 
terval counter is updated to the sum of the offset time 
value and the present Ume. Thus, all values of inter- 10 
est are maintained by a combination of keeping an ab- 
solute count of the events, and by "sliding" the con- 
tents of two countere. one of which is used to measure 
successive time intervals and the other to set a new 
event threshold for each successive interval based on is 
the offset and the absolute event count at the begin- 
ning of the interval. 

One application of the invention is in a communi- 
cations network to manage the communication con- 
nections between the network nodes and especially 20 
to detect degradation of a connection. Relevant infor- 
mation for managing the network is provided by each 
node periodically to a network management applica- 
tion program in the preferred embodiment 



25 

Descnption of the drawing : 

Fig. 1 sets one illustrative environment for use of 
the invention. A simplified, Illustrative network 
consists of two nodes and a network manage- 30 
ment system located somewhere in the network. 
Communication adapter cards at each node con- 
tain apparatus and/or software for accumulating 
event infbnmation on connections to which they 
are attached and communicating this information 35 
vra their nodes to the network manager 
Fig. 2 shows Illustrative steps executed in each 
communication adapters in tile preferred embodi- 
ment for periodically administering event coun- 
ters and interval counteis by sliding both types of 40 
countere along by offsets, ttiereby allowing tiie 
accumulattonof both relative and absolute values 
during a connection; 

Fig. 3 shows illustrative steps ttiat are executed 
by a communications adapter in tiie preferred em- 45 
bodlment upon the occun-ence of an event to be 
measured; and 

Fig. 4 shows, as an aid to understanding, one 
example of tiie occurrence of errors of a given 
type and the resulting effect of ttie errors on tiie so 
sliding counters. 

Detailed description : 



Fig. 1 shows an illustrative system environment in 
which the invention might be used. The system in- 
cludes two processing nodes 100-1 and 100-2. Each 
node has a miooprocessor (or other type of data proc- 
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essmg element) 102. The data processing element 
might consist of a desktop computer, such as a PS/2 

(Trademark)computermanufactured by International 
Business Machines, a reduced instruction set com 
puter (RISC), or other general orspeclal purpose type 
of computer. In any event, a node in tiiis illustrative 
system includes some means for the element 102 to 
communicate witii ottier nodes. In this illusti^tive em- 
bodiment, communication adapter cards 104 provide 
the communication interface between data process- 
ing element 102 of a node and other nodes via con- 
nections such as 108. In addition, tfie nodes commu- 
nicate with a network management system or applica- 
tion 106 located somewhere in tiie networie 

The purpose of tiie network manager 106 is to 
collect event information about the various connec- 
tions 108 in tiie networi<from tfie individual nodes and 
to use ttie information in any desired manner for the 
purpose of controlling and maintaining the networic 
Toward ttiis end, ttie metiiod to be described for col- 
lecting event Infomiatlon at each of the nodes in- 
cludes a mechanism for communicating information 
to the network manager 108. Typically, each node col- 
lects event Information pertinent to its end of a con- 
nection. For example, each node may receive infor- 
mation from tiie other node. It is typically a node's re- 
sponsibility to collect error statistics regarding ttie in- 
formation it receives and to communicate ttie error 
statistics to the networtc manager 106. 

The illustrative embodiment of ttie mettiod shown 
in Figs. 2 and 3 uses a number of variables to perfomi 
its functions. These variables are: 

TYPES.OF^EVENTS = the number of differ- 
ent types of events to be monitored; 

COUNT(I) = tiie number of times events of type 
I have occurred since a connection in question was 
established; 

CC(I) = a ttireshold event comparison value for 
tills event type i; 

CF(I) = a predetennined offset value tiiat is 
added to tfie contents of COUNT(I) to get ttie next 
ttireshold event comparison value; 

TIME = a counter ttiat counts ttie number of 
units of time of granularity DELAY (seconds, minutes, 
etc.) ttiat have passed since tiie connection was es^ 
tabllshed; 

TC(I) ttie present time threshold comparison 
value for this type of event; ttiis variable sets the per- 
iodic inter/als for each event type; 

TF(I) = the offset added to tiie contents of TIME 
to get ttie next time threshold comparison value for 
TC(I); in tiie illustrative embodiment, this offeet is pre- 
determined for each I; 

TS(I) = a switch ttiat indicates whether or not 
the networtc manager 106 should be notified when tiiis 
event's present measurement internal expires, i. e., 
when TIME reaches the present value contained in 
TC{I); 
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ACTION(I) = A preestablished table that con- 
tains instructions as to what type of action to perform 
at the expiration of each timing interval and at each 
event threshold crossing for each event type L 

Figs. 2 and 3 show illustrative flowcharts of the 
steps that are performed in the communication adap- 
ters 104 of a system to carry out the invention. When 
a connection like 1 08 is first established in the system, 
the steps of Fig, 2 are executed beginning at the pro- 
gram entry point INITIALIZE to begin event collection 
for the connection. Step 200 initializes TIME to zero 
to mark the beginning of the connection. Step 201 per- 
forms other necessary initialization functions. For 
each such type of event I, step 201 initializes vari- 
ables COUNT, TC and CC to beginning states. Spe- 
cifically, for each I, COUNT is set to zero, TC is set 
equal to the interval offeet TF and CC is set equal to 
CF. This means that the contents of TC that detenmi- 
nes the end of the first measuring interval Is set equal 
to the predetermined offset in TF; the present event 
threshold is set equal to the offset value in CF. 

Step 202 initializes a loop based on the value of 
I. The remaining steps of Fig. 2, executed as part of 
the loop, detenmine when the present timing interval 
for each type of event expires and "slides" both the in- 
terval threshold TC and the event threshold CC for- 
ward by their respective of^ets to establish a new in- 
terval and event threshold. These actions allow abso- 
lute values of interval and event counts to be main- 
tained, while at the same time allowing differential val- 
ues to be used for present measuring purposes. Spe- 
cifically, step 204 decrements I to establish the next 
event type for which the present Interval is checked. 
Step 206 determines if all event types have been 
processed for the present loop. If ail event types have 
been processed, step 208 Introduces a prescribed 
amount of delay in loop processing following which 
step 209 increments TIME by the DELAY anrx^unt; 
control then returns to step 202 to process the loop 
again. 

For each event type in the processing of one pass 
through the looprstep 210 determines if the value in 
TIME is less than the value in TC. If it is, the present 
timing interval for event I has not yet expired. In this 
case. Fig. 2 merely proceeds to the next event type at 
step 204. If the timing interval has expired for this 
event type I, step 212 determines firom ACTION(I) 
what action should be performed and schedules the 
action. For example, the action may be to do nothing, 
or it may be to send a message to the network man- 
ager 106 containing information also described by 
ACTION(I) so that it may track the intervals. Next step 
214 perfonms the "sliding" operations described 
above to establish parameters for the next interval, cc 
is set to CF plus COUNT. This slides the event thresh- 
old count forward by an appropriate amount to allow 
a comparison of COUNT and CC on the occurrence 
of an event to detect an event threshold crossing dur- 



ing the next interval. The total absolute event count is 
still maintained in COUNT. TC is incremented by the 
value of its offset TF to establish the absolute time val- 
ue for ending the next interval. 

5 The counters TC and CC can overflow, since they 

are finite in size. Step 21 6 detennines if an overflow 
occurred in either counter step 218 notifies the net- 
viork manager 1 06 of an overflow. This allows the net- 
work manager to be prepared for a shift in numbers 

10 on the next event message that may be received for 
this connection. Control then proceeds to INITIALIZE 
at the beginning of Fig. 2 to restart the counters. 
Otherwise, the loop beginning at step 204 is repeated 
for the next event type. 

IS The steps of Fig. 3 are executed each time an 
event of type J occurs on the connection in question 
(J is a particular instance of the event types I). Step 
300 immediately increments COUNT for the event 
type. Step 302 tests the new value of COUNT against 

20 the present threshold contained in CC. If the threshold 
is not reached, i.e., COUNT is less than CC, the rou- 
tine of Rg. 3 exits to await the next event occurrence. 
On the other hand, step 304. if the threshold is 
reached, the ACTION table is indexed by J to deter- 

25 mine the type of action to be perfonmed when the 
threshold is exceeded. Typically, this might be the 
generation of a message containing parameters of in- 
terest for this type of event and the transmission of the 
message via microprocessor 1 02 to the network man- 

30 ager 108. A simple example of such parameters might 
be the event type J. the total number of such events 
since connection from COUNT, the time since the 
connectkin was established and the number of events 
J that have occurred during the present interval. On 

35 the other hand, depending on other infonmation sent 
to the mteroprocessor, say at the expiration of each in- 
terval (Rg. 2), the mteroprocessor may be program- 
med to calculate some of the illustrative parameters 
just mentbned. and others. The particular detafls of 

40 parameter generation, etc. are not relevant to or part 
of the inventk)n being described. 

Following step 304, step 306 updates the CC and 
TC variables for the event type J. A new interval of 
time is begun by setting TC to the sum of TIME and 

45 the inten^al offset TF. The new event threshold in CC 
is set to the present contents of CC plus the event off- 
set CF. Step 308 tests for an overflow of either CC(J) 
or TC(J). If there is no overflow, the program exits. 
Otherwise, step 310 notifies the network manager 106 

50 of the overflow so that it adjust itself accordingly; step 
312 then reinitializes the counters in the same way 
that step 201 does before the program exits. 

Fig. 4 shows one example of how the contents of 
variables and intervals vary in relation to an assumed 

55 set of event J occurrences, it is assumed for illustra- 
tion and for event type J that the intervals are meas- 
ured in seconds, that the interval offset in TF is set to 
60 seconds and that the event threshold offset CF is 
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set to 5. At the beginning of the interval identified as 
400, it is assumed that the total event count CC is 0. 
I.e., no events J have yet occurred on the connection' 
Therefore. COUNT equals 0 at 400 and the threshold 
count CC equals 5 (from step 214). It is further as- 5 
sumed that the connection has been In existence for 
3 minutes at 400. The effects of the contents of DE- 
LAY are ignored for this example, since it doesn't ma- 
terially affect the principles of operation that are being 
Illustrated. Therefore, TC is set to TIME + CF = 180 + 10 
60 = 240 seconds at the beginning of 400. During in- 
terval 400, two events J occur as shown at 406. 
COUNT becomes equal to 2 as a result of these 
events (step 300). However, the interval threshold of 
5 IS not exceeded (step 302) because COUNT (2) is 15 
less than CC (5). At the beginning of the next interval 
402, COUNT still equals 2 (the total number of events 
J that have occunnBd). CC Is set to 7 (step 214) the 
contents of COUNT plus the event offset 5. TC be- 
comes 300. its eariier value (240) plus the inteival off- 20 
set 60 seconds. During Interval 402, 1 more event J 
occurs at 408. COUNT becomes 3, The threshold in 
CC (now 7) is still not exceeded. At the beginning of 
interval 404, COUNT equals 3, CC is updated to 8 
(COUNT plus CF) and TC becomes 360 seconds 25 
Dunng interval 404. 5 events J are assumed to occur 
On the fifth event at 410, COUNT becomes equal to 
8. This equals the present sikJing event threshold In 
CC. Therefore, step 302 triggers a threshold crossing. 
Step 304 then takes the appropriate action to notify 30 
the networic manager 106 of the appropriate informa- 
tion as described by ACTION. Step 306 updates CC 
and TC to begin a new interval in this preferred em- 
bodiment 
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Claims 



1. 'n a communications networic comprising a net- 
work management application program, a plural- 40 
ity of data processing nodes, each node further 
comprising at least one communications adapter 
interfacing the node to a connection to another 
node of the networic. a method of detecting event 
thresholds executed by the communications 45 
adapter, said method characterized in that it com- 
prises the steps of : 

(a) measuring successive intervals of time, 

(b) maintaining an indication of the total num- 
ber of events of a prescribed type that have so 
occurred on the connection. 

(c) establishing an event threshold compari- 
son value at the beginning of each inteival rel- 
ative to the total number of events that have 
occurred up to that point 55 

(d) in response to a prescribed stimulus, com- 
paring the indication of the total number of 
events that have occurred to the event com- 



parison threshold value to detemiine if the 
threshold has been reached during the Inter- 
val, and 

(e) transmitting the event information to the 
networic management application program. 

2. The method of claim 1 wherein the step of meas- 
uring successlveintervalsof tlmefurthercompris- 

incrementing the contents of an interval 
timer by a prestribed amount at the expiration of 
each interval defined by the timer to define the ex- 
piration time of the next interval defined by the 
timer relath^e to real time. 

3. The method of daims 1 or 2, wherein the step of 
maintaining an indication of the total number of 
events further comprises 

incrementing an event counter in response 
to each occumence of an event and wherein the 
prescribed stimulus is the occunrence of an event. 

4. The method of claims 1, 2 or 3, wherein the step 
of establishing an event threshold further com- 
prises 

setting a threshold counter to the sum of 
the total event count and a predetermined offeet 
value. 

5. The method of claims 1 to 4, further comprising 
the steps of : 

(0 acth^ating an alert in the event a threshold 
has been reached during an interval, 
(g) updating the interval timer and the event 
threshold comparison value when the event 
threshold is reached, said interval timer fur- 
ther comprises a first counter and the step of 
establishing an event threshold comparison 
value for each successive interval further 
comprises incrementing a second counter. 

6. A method of managing event counters, compris- 
ing the steps of 

(a) incrementing the contents of an interval 
timer by a prescribed amount at the expiration 
of each interval defined by the timer to define 
the expiration time of the next interval defined 
by the timer relative to real time, 

(b) establishing an event threshold compari- 
son value at the beginning of each interval rel- 
ative to the total number of events that have 
already occunred, 

(c) incrementing an event counter in response 
to the occurrence of an event and 

(d) comparing the event counter to the event 
comparison threshold value to determine if the 
threshold has been reached during a present 
interval. 
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A method of managing event counters, compris- 
ing the steps of 

Initializing an event counter, a sliding 
event threshold counter and a sliding interval 
counter to prescribed Initial states at the start of 5 
counter management, 

at the expiration of an interval specified by 
the contents of the sliding Interval counter, 

a) Incrementing the sliding interval counter by 

an offset time value, and io 

b) updating the sliding event threshold counter 
by the sum of an offset event value and the 
event counter, 

Incrementing the event counter on 
each occurrence of an event to be counted, 15 
and each time the event counter exceeds a 
threshold established by the sliding threshold 
event counter, 

c) incrementing the sliding threshold event 
counter by the contents of the offset event val- 20 
ue, and 

d) updating the sliding interval counter to the 
sum of the offset time value and the present 
time. 

25 

For use in a communications network comprising 
a network management application program, a 
plurality of data processing nodes, each node fur- 
ther comprising at least one communications 
adapter interfecing the node to a connection to 30 
another node of the network and containing appa- 
ratus for detecting event thresholds, said appara- 
tus further comprising 

- means for measuring successive internals of 
time, 35 

- means for maintaining an indicatksn of the to- 
tal number of events of a prescribed type that 
have occurred on the connection, 

- means for establishing an event threshold 
comparison value at the beginning of each in- 40 
terval relative to the total number of events 

that have occun^ed up to that point 

- means responsive to a prescribed stimulus 
for comparing the indication of the total nunrv 

ber of events that have occurred to the event 45 
comparison threshold value to detenmine if the 
threshold has been reached during the inter- 
val, and 

- means for transmitting the event infonmation 

to the networic management application pro- so 
gram. 

The apparatus of daim 8, wherein the measuring 
means further comprises an interval timer, means 
for incrementing the contents of the interval timer 55 
by a prescribed amount at the expiration of each 
interval defined by the timer to define the expira- 
tion time of the next Interval defined by the timer 



relative to real time. 

1 0. The apparatus of claims 8 or 9, wherein the main- 
taining means further comprises an event coun- 
ter, means for Incrementing the event counter in 
response to each occunrence of an event, and 
wherein the prescribed stimulus is the occunrence 
of an event. 

11. The apparatus of claims 8 to 10, wherein the es- 
tablishing means further comprises 

- a threshold counter, 

- means for setting the threshold counter to 
the sum of the event counter and a predeter- 
mined offset value. 

12. The apparatus of claims 8 to 11, further compris- 
ing 

- means responsive to the comparing means 
for activating an alert in the event a threshold 
has been reached during an Interval. 

- means for controlling the inten^al timer to be- 
gin a new interval and means for updating the 
event threshold comparison value when the 
event threshold is reached, and wherein the 
interval timer further comprises a first counter 
and the establishing means further comprises 
means for. incrementing a second counter. 

13. An apparatus for managing event counters, conrv 
prising 

- means for incrementing the contents of an 
interval timer by a prescribed amount at the 
expiration of each interval defined by the timer 
to define the expiration time of the next inter- 
val defined by the timer relative to real time, 

- means for establishing an event threshold 
comparison value at the beginning of each In- 
terval relatWe to the total number of events 
that have already occunBd, 

- means for incrementing an event counter in 
response to the occunrence of an event and 

- means for comparing the event counter to 
the event comparison threshold value to de- 
termine if the threshold has been reached dur- 
ing a present interval. 
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